ITQ/Datarush
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: added build and tagging

Browse Source
This commit is contained in:
ITQ
2025-12-14 14:32:35 +03:00
parent fe355677db
commit 98ec96c8aa
3 changed files with 113 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitlab-ci.yml
+101 -116
View File
@@ -1,9 +1,8 @@
stages: stages:
# - build - build
- test - test
- sast - sast
# - dast - tag
# - tag
# - deploy # - deploy
include: include:
@@ -16,33 +15,27 @@ include:
default: default:
retry: 1 retry: 1
# variables: variables:
# BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE BASE_IMAGE_NAME: $CI_REGISTRY_IMAGE
# TRIVY_CACHE_DIR: .cache/trivy TRIVY_CACHE_DIR: .cache/trivy
# TRIVY_NO_PROGRESS: "true" TRIVY_NO_PROGRESS: "true"
# TRIVY_TIMEOUT: "10m0s" TRIVY_TIMEOUT: "10m0s"
# TRIVY_USERNAME: $CI_REGISTRY_USER TRIVY_USERNAME: $CI_REGISTRY_USER
# TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD
# TRIVY_REGISTRY: $CI_REGISTRY TRIVY_REGISTRY: $CI_REGISTRY
# UV_PROJECT_ENVIRONMENT: .venv DOCKER_HOST: "tcp://docker:2375"
# UV_CACHE_DIR: .cache/uv DOCKER_TLS_CERTDIR: ""
# BUILDAH_ISOLATION: oci
# STORAGE_DRIVER: vfs
# DOCKER_HOST: "tcp://docker:2375"
# DOCKER_TLS_CERTDIR: ""
# cache: cache:
# key: "${CI_COMMIT_REF_SLUG}" key: "${CI_COMMIT_REF_SLUG}"
# paths: paths:
# - $TRIVY_CACHE_DIR - $TRIVY_CACHE_DIR
# - $UV_CACHE_DIR policy: pull-push
# - $UV_PROJECT_ENVIRONMENT
# policy: pull-push
.docker-job: &docker-job .docker-job: &docker-job
image: docker:cli image: docker.io/docker:cli
services: services:
- docker:dind - docker.io/docker:dind
before_script: before_script:
- docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
@@ -50,12 +43,13 @@ default:
image: quay.io/containers/buildah:latest image: quay.io/containers/buildah:latest
variables: variables:
STORAGE_DRIVER: vfs STORAGE_DRIVER: vfs
BUILDAH_ISOLATION: oci
before_script: before_script:
- buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY - buildah login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
.trivy-fs-template: &trivy-fs-scan .trivy-fs-template: &trivy-fs-scan
image: image:
name: aquasec/trivy:latest name: docker.io/aquasec/trivy:latest
entrypoint: [""] entrypoint: [""]
cache: cache:
paths: paths:
@@ -82,44 +76,43 @@ default:
- if: $SAST_DISABLED - if: $SAST_DISABLED
when: never when: never
# .trivy-image-template: &trivy-image-scan .trivy-image-template: &trivy-image-scan
# stage: security image:
# image: name: docker.io/aquasec/trivy:latest
# name: aquasec/trivy:latest entrypoint: [""]
# entrypoint: [""] cache:
# cache: paths:
# paths: - $TRIVY_CACHE_DIR
# - $TRIVY_CACHE_DIR policy: pull-push
# policy: pull-push before_script:
# before_script: - mkdir -p $TRIVY_CACHE_DIR
# - mkdir -p $TRIVY_CACHE_DIR script:
# script: - |
# - | trivy image \
# trivy image \ --scanners vuln \
# --scanners vuln \ --format cyclonedx \
# --format cyclonedx \ --output image-sbom-${IMAGE_TYPE}.json \
# --output image-sbom-${IMAGE_TYPE}.json \ $IMAGE_NAME:$CI_COMMIT_SHA
# $IMAGE_NAME:$CI_COMMIT_SHA - |
# - | trivy image \
# trivy image \ --format sarif \
# --format sarif \ --output gl-sast-image-${IMAGE_TYPE}-report.json \
# --output gl-sast-image-${IMAGE_TYPE}-report.json \ $IMAGE_NAME:$CI_COMMIT_SHA
# $IMAGE_NAME:$CI_COMMIT_SHA allow_failure: true
# allow_failure: true artifacts:
# artifacts: reports:
# reports: sast: gl-sast-image-${IMAGE_TYPE}-report.json
# sast: gl-sast-image-${IMAGE_TYPE}-report.json paths:
# paths: - image-sbom-${IMAGE_TYPE}.json
# - image-sbom-${IMAGE_TYPE}.json - gl-sast-image-${IMAGE_TYPE}-report.json
# - gl-sast-image-${IMAGE_TYPE}-report.json expire_in: 1 week
# expire_in: 1 week when: always
# when: always rules:
# rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH - if: $CI_COMMIT_TAG
# - if: $CI_COMMIT_TAG - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
# - if: $CI_PIPELINE_SOURCE == 'merge_request_event' - if: $SAST_DISABLED
# - if: $SAST_DISABLED when: never
# when: never
# .webhook-template: &webhook-config # .webhook-template: &webhook-config
# image: curlimages/curl:latest # image: curlimages/curl:latest
@@ -143,6 +136,7 @@ default:
--tag $IMAGE_NAME:$CI_COMMIT_SHA \ --tag $IMAGE_NAME:$CI_COMMIT_SHA \
--file $CONTAINERFILE \ --file $CONTAINERFILE \
--target $BUILDTARGET \ --target $BUILDTARGET \
--build-arg SERVICE_NAME=${SERVICE_NAME} \
--layers \ --layers \
--cache-from $IMAGE_NAME-cache \ --cache-from $IMAGE_NAME-cache \
--cache-to $IMAGE_NAME-cache \ --cache-to $IMAGE_NAME-cache \
@@ -187,48 +181,39 @@ default:
when: manual when: manual
allow_failure: true allow_failure: true
# build-runtime: build-server:
# <<: *build-config <<: *build-config
# variables: variables:
# IMAGE_NAME: $BASE_IMAGE_NAME/backend IMAGE_NAME: $BASE_IMAGE_NAME/server
# CONTAINERFILE: Containerfile CONTAINERFILE: Containerfile
# BUILDTARGET: runtime BUILDTARGET: runtime
SERVICE_NAME: server
# build-tests: build-migrate:
# <<: *build-config <<: *build-config
# variables: variables:
# IMAGE_NAME: $BASE_IMAGE_NAME/backend-tests IMAGE_NAME: $BASE_IMAGE_NAME/migrate
# CONTAINERFILE: Containerfile CONTAINERFILE: Containerfile
# BUILDTARGET: tests BUILDTARGET: runtime
SERVICE_NAME: migrate
# build-migrations: golangci-lint:
# <<: *build-config stage: test
# variables: image: docker.io/golangci/golangci-lint:latest-alpine
# IMAGE_NAME: $BASE_IMAGE_NAME/backend-migrations variables:
# CONTAINERFILE: Containerfile GOLANGCI_LINT_CACHE: $CI_PROJECT_DIR/.cache/golangci-lint
# BUILDTARGET: migrations cache:
key: golangci-lint
# build-ml: paths:
# <<: *build-config - .cache/golangci-lint
# when: manual - /go/pkg/mod
# variables: script:
# IMAGE_NAME: $BASE_IMAGE_NAME/ml - golangci-lint run -c .golangci.yaml ./...
# CONTAINERFILE: Containerfile allow_failure: true
# BUILDTARGET: ml rules:
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
# lint: - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
# <<: *uv-job - if: $CI_COMMIT_TAG
# stage: test
# script:
# - source $HOME/.local/bin/env
# - uv sync --group linters --frozen
# - source $UV_PROJECT_ENVIRONMENT/bin/activate
# - just lint
# allow_failure: true
# rules:
# - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
# - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
# - if: $CI_COMMIT_TAG
# test: # test:
# <<: *docker-job # <<: *docker-job
@@ -292,18 +277,18 @@ default:
sast-filesystem: sast-filesystem:
<<: *trivy-fs-scan <<: *trivy-fs-scan
# sast-image-: sast-image-server:
# <<: *trivy-image-scan <<: *trivy-image-scan
# variables: variables:
# IMAGE_NAME: $BASE_IMAGE_NAME/backend IMAGE_NAME: $BASE_IMAGE_NAME/server
# IMAGE_TYPE: runtime IMAGE_TYPE: runtime
# dependencies: dependencies:
# - build-runtime - build-server
# tag-backend: tag-server:
# <<: *tag-config <<: *tag-config
# variables: variables:
# IMAGE_NAME: $BASE_IMAGE_NAME/backend IMAGE_NAME: $BASE_IMAGE_NAME/server
# webhook-backend-deploy: # webhook-backend-deploy:
# <<: *webhook-config # <<: *webhook-config
Containerfile
+12 -6
View File
@@ -1,8 +1,8 @@
ARG GOARCH=amd64 ARG GOARCH=amd64
ARG GOOS=linux ARG GOOS=linux
ARG CGO_ENABLED=0 ARG CGO_ENABLED=0
ARG VERSION=1.0.0
ARG BUILD_TIME=unknown ARG BUILD_TIME=unknown
ARG SERVICE
# Stage 1: Build # Stage 1: Build
FROM docker.io/golang:1.24-alpine AS build FROM docker.io/golang:1.24-alpine AS build
@@ -12,32 +12,38 @@ ARG GOARCH
ARG CGO_ENABLED ARG CGO_ENABLED
ARG VERSION ARG VERSION
ARG BUILD_TIME ARG BUILD_TIME
ARG SERVICE
WORKDIR /src WORKDIR /src
COPY go.mod go.sum ./ COPY go.mod go.sum ./
RUN go mod download RUN --mount=type=cache,target=/root/.cache/go-build \
--mount=type=cache,target=/go/pkg/mod \
go mod download
COPY . . COPY . .
RUN CGO_ENABLED=${CGO_ENABLED} \ RUN --mount=type=cache,target=/root/.cache/go-build \
--mount=type=cache,target=/go/pkg/mod \
CGO_ENABLED=${CGO_ENABLED} \
GOOS=${GOOS} \ GOOS=${GOOS} \
GOARCH=${GOARCH} \ GOARCH=${GOARCH} \
go build -trimpath \ go build -trimpath \
-ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \ -ldflags="-s -w -X 'main.BuildTime=${BUILD_TIME}'" \
-o /bin/app ./cmd/server -o /bin/${SERVICE} ./cmd/${SERVICE}
# Stage 2: Runtime # Stage 2: Runtime
FROM docker.io/alpine:3.22 AS runtime FROM docker.io/alpine:3.22 AS runtime
ARG VERSION ARG VERSION
ARG BUILD_TIME ARG BUILD_TIME
ARG SERVICE
RUN addgroup -S app && adduser -S -G app app RUN addgroup -S app && adduser -S -G app app
WORKDIR /app WORKDIR /app
COPY --from=build /bin/app /app/bin COPY --from=build /bin/${SERVICE} /app/bin
RUN chown app:app /app/bin && chmod +x /app/bin RUN chown app:app /app/bin && chmod +x /app/bin
Containerfile.migrate
-51
View File
@@ -1,51 +0,0 @@
ARG GOARCH=amd64
ARG GOOS=linux
ARG CGO_ENABLED=0
ARG VERSION=1.0.0
ARG BUILD_TIME=unknown
# Stage 1: Build
FROM docker.io/golang:1.24-alpine AS build
ARG GOOS
ARG GOARCH
ARG CGO_ENABLED
ARG VERSION
ARG BUILD_TIME
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=${CGO_ENABLED} \
GOOS=${GOOS} \
GOARCH=${GOARCH} \
go build -trimpath \
-ldflags="-s -w -X 'main.Version=${VERSION}' -X 'main.BuildTime=${BUILD_TIME}'" \
-o /bin/app ./cmd/migrate
# Stage 2: Runtime
FROM docker.io/alpine:3.22 AS runtime
ARG VERSION
ARG BUILD_TIME
RUN addgroup -S app && adduser -S -G app app
WORKDIR /app
COPY --from=build /bin/app /app/bin
RUN chown app:app /app/bin && chmod +x /app/bin
USER app
LABEL org.opencontainers.image.version=${VERSION}
LABEL org.opencontainers.image.created=${BUILD_TIME}
ENTRYPOINT ["/app/bin"]
CMD [""]